Azure 容器实例通过专用终结点连接到 Azure SQL 数据库超时

Question

我在尝试通过专用终结点连接到 Azure SQL 数据库时遇到 Azure 容器实例 (ACI) 超时问题。我的设置全部由 Terraform 配置，如下：

数据库

resource "azurerm_sql_server" "azure_sql_server" {
  name                         = "azure-sql-server"
  resource_group_name          = data.azurerm_resource_group.arc_resource_group.name
  location                      = data.azurerm_resource_group.arc_resource_group.location
  administrator_login          = var.administrator_login
  administrator_login_password = var.administrator_login_password
  version                       = "12.0"
}

resource "azurerm_sql_database" "azure_sql_database" {
  name                = "database"
  server_name         = azurerm_sql_server.arc_azure_sql_server.name
  resource_group_name = data.azurerm_resource_group.arc_resource_group.name
  location            = data.azurerm_resource_group.arc_resource_group.location
}

容器实例

resource "azurerm_container_group" "nginx_container" {
  name                = "nginx-container-group"
  resource_group_name = data.azurerm_resource_group.arc_resource_group.name
  location            = data.azurerm_resource_group.arc_resource_group.location
  ip_address_type     = "Private"
  os_type             = "Linux"
  subnet_ids          = [azurerm_subnet.subnet_b.id]

  container {
    name   = "nginx-container"
    image  = "${var.acr_repository}.azurecr.io/docker_image:latest"
    cpu    = "0.5"
    memory = "1.5"

    environment_variables = {
        "DB_HOST" = format("%s.database.windows.net", azurerm_sql_server.arc_azure_sql_server.name)
    }
    
    ports {
      port     = 80
      protocol = "TCP"
    }
  }
}

虚拟网络

data "azurerm_virtual_network" "existing_vnet" {
  name                = "vnet-uks-dev"
  resource_group_name = data.azurerm_resource_group.arc_resource_group.name
}

resource "azurerm_subnet" "subnet_a" {
  name                 = "sql-sn"
  resource_group_name  = data.azurerm_resource_group.arc_resource_group.name
  virtual_network_name = data.azurerm_virtual_network.existing_vnet.name
  address_prefixes     = ["10.2.1.0/24"]
}

resource "azurerm_subnet" "subnet_b" {
  name                 = "aci-sn"
  resource_group_name  = data.azurerm_resource_group.arc_resource_group.name
  virtual_network_name = data.azurerm_virtual_network.existing_vnet.name
  address_prefixes     = ["10.2.2.0/24"]
  service_endpoints    = ["Microsoft.Sql"]
  delegation {
    name = "aci"
    service_delegation {
      name    = "Microsoft.ContainerInstance/containerGroups"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }
}

resource "azurerm_subnet" "subnet_c" {
  name                 = "private-link-sn"
  resource_group_name  = data.azurerm_resource_group.arc_resource_group.name
  virtual_network_name = data.azurerm_virtual_network.existing_vnet.name
  address_prefixes     = ["10.2.3.0/24"]
}

DNS 和专用端点

resource "azurerm_private_dns_zone" "sql_private_dns_zone" {
  name                = "privatelink.database.windows.net"
  resource_group_name = data.azurerm_resource_group.arc_resource_group.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "vnet_link" {
  name                  = "vnet-link-to-private-dns"
  resource_group_name   = data.azurerm_resource_group.arc_resource_group.name
  private_dns_zone_name = azurerm_private_dns_zone.sql_private_dns_zone.name
  virtual_network_id    = data.azurerm_virtual_network.existing_vnet.id
}

resource "azurerm_sql_virtual_network_rule" "allow_aci_subnet" {
  name                = "AllowACISubnet"
  resource_group_name = data.azurerm_resource_group.arc_resource_group.name
  server_name         = azurerm_sql_server.arc_azure_sql_server.name
  subnet_id           = azurerm_subnet.subnet_b.id
}

resource "azurerm_private_endpoint" "database_private_endpoint" {
  name                = "pe-database"
  location            = data.azurerm_resource_group.arc_resource_group.location
  resource_group_name = data.azurerm_resource_group.arc_resource_group.name
  subnet_id           = azurerm_subnet.subnet_c.id

  private_service_connection {
    name                           = "psc-sql"
    private_connection_resource_id = azurerm_sql_server.arc_azure_sql_server.id
    subresource_names             = ["sqlServer"]
  }

  private_dns_zone_group {
    name                 = "default"
    private_dns_zone_ids = [azurerm_private_dns_zone.sql_private_dns_zone.id]
  }
}

鉴于此设置，我在 ACI 中的应用程序在尝试写入 Azure SQL 数据库时遇到超时。可能是什么原因造成的？如何通过专用端点成功建立 ACI 和 SQL 数据库之间的连接？

我用 3 个子网作为私有端点构建了这个，并且容器实例必须具有专用子网并且不会容纳额外的资源。

我已经确认数据库连接字符串是正确的。我已确认服务器正在使用 azure-sql-server.database.windows.net 作为其服务器名称进行部署。

Answer 1

我尝试检查通过专用终结点连接到 Azure SQL 数据库的 Azure 容器实例超时问题，该问题通常是由多种因素引起的。

我同意 @harshavmb 的观点，他提到的是导致您面临问题的因素。

连接到 Azure SQL 数据库时 Azure 容器实例 (ACI) 超时的问题可能是由几个不同的因素造成的。

• 确保与子网或虚拟网络关联的网络安全组 (NSG) 不会阻止 ACI 和 Azure SQL 数据库之间的流量。
• 仔细检查专用终结点的配置并确保其正确链接到 Azure SQL Server。
• 由于您使用的是专用端点，请确保 SQL Server 的 DNS 解析配置正确，并且 ACI 可以解析 SQL Server 的专用 IP。
• 您已在

  subnet_b

  上配置了 Microsoft.Sql 的服务端点，但您的专用端点位于

  subnet_c

  中。确保服务端点已正确设置以允许流量到达 SQL Server，并检查 Azure SQL Server 上是否有任何可能阻止流量的防火墙规则。

我尝试了一个演示配置，它可以帮助您解决遇到的阻止程序问题。

我的演示配置：

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "Demorg-vk"
  location = "West US"
}

resource "azurerm_virtual_network" "example" {
  name                = "vksb-network"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_subnet" "example_sql" {
  name                 = "vksb-sql-subnet"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_subnet" "example_aci" {
  name                 = "vksb-aci-subnet"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.2.0/24"]
  delegation {
    name = "aci"
    service_delegation {
      name    = "Microsoft.ContainerInstance/containerGroups"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }
}

resource "azurerm_subnet" "example_private_endpoint" {
  name                 = "vksb-private-endpoint-subnet"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.3.0/24"]
}


resource "azurerm_mssql_server" "example" {
  name                         = "vksb-sql-server"
  resource_group_name          = azurerm_resource_group.example.name
  location                     = azurerm_resource_group.example.location
  version                      = "12.0"
  administrator_login          = "sqladminvk"
  administrator_login_password = "Intel@1901"
  identity {
    type = "SystemAssigned"
  }
}


resource "azurerm_private_dns_zone" "example" {
  name                = "privatelink.database.windows.net"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "example" {
  name                  = "vksb-vnet-link"
  resource_group_name   = azurerm_resource_group.example.name
  private_dns_zone_name = azurerm_private_dns_zone.example.name
  virtual_network_id    = azurerm_virtual_network.example.id
}

resource "azurerm_private_endpoint" "example" {
  name                = "vksb-private-endpoint"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  subnet_id           = azurerm_subnet.example_private_endpoint.id

  private_service_connection {
    name                           = "vksb-sql-connection"
    private_connection_resource_id = azurerm_mssql_server.example.id
    subresource_names              = ["sqlServer"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "default"
    private_dns_zone_ids = [azurerm_private_dns_zone.example.id]
  }
}

resource "azurerm_container_group" "example" {
  name                = "vksb-container-group"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  os_type             = "Linux"
  ip_address_type     = "Private"
  subnet_ids          = [azurerm_subnet.example_aci.id]

  container {
    name   = "example-container"
    image  = "nginx:latest"
    cpu    = "0.5"
    memory = "1.5"

    ports {
      port     = 80
      protocol = "TCP"
    }
  }
}

输出：